CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This issue affects Rocket Maintenance Mode & Coming Soon Page: from n/a through 4.3.
Explanation of Vulnerability in Simple Terms
Rocket Maintenance Mode & Coming Soon Page versions 4.3 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts into the plugin settings. When other users view affected pages, the injected code executes in their browsers, potentially compromising their sessions or stealing data.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers when they view the maintenance or coming soon page.
Potential impact on your site
A compromised admin account can inject code affecting all site visitors, risking credential theft or malware distribution.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site and a victim must visit the affected page.
Key dates
External resources
Related vulnerabilities
